VPN NAT within IPSec Tunnel

mdargin · ‎10-10-2007

Is it ok to place a 3825 Head end VPN router in a DMZ and Use a private address for the external Interface and perform a NAT to a single Public address.

All users connecting to the IPSec Site to Site VPN will use the Public address and the firewall will perform the translation. The IPSec Tunnel will be established on the 3825 router with the private address.

Is there a potential for any problems with this configuration?

rmeans · ‎10-12-2007

I have a similar scenario with a PIX and 3030. The firewall rules look like

access-list outside_acl permit icmp any host 1.1.1.1

access-list outside_acl permit esp any host 1.1.1.1

access-list outside_acl permit udp any host 1.1.1.1 eq isakmp

access-list outside_acl permit udp any host 1.1.1.1 eq 4500

access-list outside_acl permit tcp any host 1.1.1.1 eq 10000

static (dmz,outside) 1.1.1.1 192.168.199.3 netmask 255.255.255.255 0 0

Rick